This week delivered a masterclass in why “where do I keep my crypto?” is the most underrated question in the industry. In the space of 48 hours, India’s biggest exchange got caught in a public fight with blockchain sleuths over $16 million that walked out of its old wallets, and one of the most regulated exchanges on the planet admitted it mishandled customer money badly enough to earn a $3.6 million fine. One is a messy dispute over a hot wallet nobody should still have been using. The other is a regulated, audited giant tripping over its own plumbing for years. Together, they are a useful map of how exchanges actually hold your money — and how to judge whether yours deserves your trust.
CoinDCX vs the on-chain detectives
The drama started late on October 21, when Darcy, an investigator at blockchain security firm Salus, flagged on-chain movement from addresses attributed to CoinDCX: roughly 15.99 million USDT and 5,783.81 TRX, about $16 million in total, moving through a TRON wallet before being split and scattered — with some flows reportedly landing in deposit addresses at Binance, OKX and Gate, per reporting by Cryptorank, Protos and Crypto Briefing.
CoinDCX’s first response was emphatic denial: the exchange insisted the addresses were created in January 2025, compromised in the exchange’s July 2025 hack, and “have not been used by CoinDCX since,” calling the circulating claims misleading.
Then the story shifted. In follow-up statements, CoinDCX acknowledged that users kept depositing into the retired addresses anyway, and that the exchange ran a routine “sweeping” process to collect those deposits and secure them. “For a particular period, this sweeping process failed,” the exchange said — and the failure only surfaced publicly once Darcy’s post went viral. CoinDCX says it credited every affected user deposit and absorbed “some operational losses,” without detailing how $16 million could go unaccounted for over such a long stretch.
That account did not convince the industry’s most famous sleuth. ZachXBT alleged the deposit address in question (identified by the prefix TQKJQ) stayed in active use by a liquidity provider for ten months after the July 2025 incident, with gas and user deposits recorded as recently as April and May 2026 — directly contradicting CoinDCX’s claim the addresses were retired. He put roughly $15.8 million in user deposits “unaccounted for” and urged users to withdraw: “Withdraw all funds from CoinDCX if you value your assets. Its co-founders are clowns running a circus.”
A few facts are undisputed: CoinDCX lost $44 million in July 2025 when a hot wallet used to provide liquidity on a partner exchange was compromised (a software engineer was later arrested in the investigation), and the October transfers involved addresses tied to that era. What remains in dispute is the timeline — whether those addresses were truly dead, or still quietly collecting money — and neither ZachXBT’s $15.8 million figure nor the “new hack” theory has been independently audited. CoinDCX maintains customer funds were safe, trading continued normally, and its active wallets were untouched.
Coinbase’s Irish fine: the regulated side of the problem
If the CoinDCX saga is about chaos, the Coinbase case is about complacency at scale. On October 22, the Central Bank of Ireland fined Coinbase Ireland €3.25 million (about $3.6 million) for safeguarding failures that ran from November 2020 to August 2025, per CoinDesk, CoinTelegraph and Unchained Crypto reporting.
The details are technical but telling. Coinbase Ireland is an electronic-money institution — the entity that issues and redeems the e-money customers convert into crypto — which puts its customer cash under Ireland’s strict safeguarding rules. The regulator found the designated safeguarding account was left underfunded for extended periods (coding errors left it underfunded by an average of 0.54% through 2023 and early 2024), 30 institutional clients’ dollars were parked in the wrong US accounts for 19 months, and accounts were commingled during the 2023 Silvergate banking crisis. The CBI’s enforcement director, Karen O’Leary, said the firm relied excessively on its US parent for safeguarding controls, lacked local expertise, and failed to escalate material changes. The €3.25 million figure already reflects a 30% settlement discount — the base sanction was €4.65 million — and it still needs Ireland’s High Court to confirm it.
Coinbase says it self-reported the issues in January 2024, that everything is remediated (a dedicated Head of Safeguarding, double third-party validations, a €25 million guaranty bond), and — crucially — that no customer lost money or access. That is the real distinction in this case: a regulatory failure that never became a customer loss. But it is also Coinbase’s second Irish fine in about a year, after a €21.5 million anti-money-laundering penalty in 2025.
How exchanges actually hold your money
Both stories are easier to read once you know where the bodies are buried — literally, where exchanges park assets:
- Hot wallets are online and always ready, used for day-to-day withdrawals and liquidity. They’re convenient and vulnerable — the July 2025 CoinDCX theft hit exactly this kind of wallet.
- Cold wallets are offline vaults where most customer assets should sit. Separating the two, and moving money between them with strict processes, is the industry’s basic hygiene.
- Deposit addresses and “sweeping” are the plumbing in between. When you deposit crypto, you usually send it to a unique address; the exchange’s systems periodically “sweep” those addresses into its main wallets. CoinDCX’s saga is, at its core, a sweeping failure — money piled up in pipes nobody was watching.
- Safeguarding rules are the legal version of the same idea for fiat. Regulated entities must keep customer cash in designated accounts, fully funded, separate from company money. Ireland’s case against Coinbase is a textbook illustration of what happens when an exchange treats its own global plumbing as a substitute for those local rules.
A quick trust checklist for your exchange
No exchange is risk-free — regulated or not — but these two weeks suggest what to look for before parking serious money:
- How it discloses trouble. CoinDCX’s shifting account — denial first, “failed sweeping” later — is exactly the pattern investigators flagged. The cleanest signal of a trustworthy exchange is a full, dated post-mortem.
- Whether “no customer loss” is provable, not just claimed. Proof-of-reserves reports and third-party audits are imperfect, but an exchange that publishes them is at least making a checkable claim.
- How long problems run. Coinbase’s safeguarding issues ran for nearly five years before remediation. A licence and a settlement aren’t the same as a clean bill of health.
- Hot wallet discipline. A single breach in July 2025 should never still be generating deposit addresses in May 2026 — if on-chain activity contradicts the official story, believe the chain.
The takeaway
This week gave us the same lesson from two directions: at CoinDCX, possibly a hot-wallet ghost town that kept collecting deposits; at Coinbase, a regulated giant that let customer-money plumbing drift for years. Neither story has produced a proven customer loss — and that matters — but both show that trust in an exchange isn’t about branding, size or even regulation. It’s about custody discipline: who holds the keys, where the money actually sits, and how fast the exchange tells the truth when something breaks. Check your exchange against that standard before the next scare, not after.
